GHSA-cqr2-h44g-v75v

Dashboard / Vulnerabilities / GHSA-cqr2-h44g-v75v

GHSA-cqr2-h44g-v75v

Summary: n8n: Cross-Tenant Project-Member PII Disclosure via Missing Per-Project Scope Check on Role Assignment Endpoints

Details: ## Impact The endpoints `/rest/roles/:slug/assignments` and `/rest/roles/:slug/assignments/:projectId/members` checked only that the caller could manage the role type, not that they could see the project named in the request. A user holding role-management permission could therefore name any project on the instance and read back its members' names and email addresses. The patch adds a project-access check to both routes, hiding projects the caller cannot see and returning not-found for a project it cannot list. ## Patches The issue has been fixed in n8n versions 2.38.2 and 2.37.7. Users should upgrade to one of these versions or later to remediate the vulnerability. ## Workarounds If upgrading is not immediately possible, administrators should consider the following temporary mitigations: - Restrict n8n instance access to fully trusted users only. - Audit and revoke any custom global roles that carry the `role:manageProject` scope, limiting that scope to fully trusted users only. These workarounds do not fully remediate the risk and should only be used as short-term mitigation measures.

References: https://github.com/n8n-io/n8n/security/advisories/GHSA-cqr2-h44g-v75v, https://nvd.nist.gov/vuln/detail/CVE-2026-86085, https://github.com/n8n-io/n8n, https://github.com/n8n-io/n8n/releases/tag/[email protected], https://github.com/n8n-io/n8n/releases/tag/[email protected]